General

  • Target
    TNT AWB 9066721066.exe
  • Size 878KB
  • Sample210712-sp4grsd78x
  • SHA256 69bd3426cb69349ccb68b8ff641f05c51931a7c8a3d563c0234eab905535e031
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.3

C2
  • http://www.xn--vcsr9nd2hesf.com/g820/

Decoy
  • bitglassqafr-qa.com

  • lotstech.com

  • baizdm.com

  • techosbienesraices.com

  • theaspiresports.com

  • abiaofashion.com

  • doonokthai.com

  • acpmreviewtext.com

  • subskription.net

  • baderaum.com

  • 054ioyt.com

  • askmelaptop.com

  • cashpaymentus.com

  • superstaybrooklynbronze.com

  • shop-elektro.com

  • vitaformalisboa.com

  • revealrepatterncoaching.com

  • homesbymariet.com

  • kjfdjjkdfefjefd.com

  • memorymanagersindex.com

Targets

    • Target
      TNT AWB 9066721066.exe
    • Size 878KB
    • SHA256 69bd3426cb69349ccb68b8ff641f05c51931a7c8a3d563c0234eab905535e031
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks